build: bundle extension with esbuild#55
Merged
Merged
Conversation
The extension shipped every tsc-emitted file plus the full node_modules tree in the .vsix (198 files, 361KB). Bundling src/extension.ts into a single minified dist/extension.js with esbuild inlines the runtime deps (all pure JS) and drops node_modules from the package: 7 files, 75KB (-79%), with faster activation since the host resolves one module instead of ~190. tsc stays for type-checking (--noEmit) and for compiling tests to out/. Also fixes a pre-existing ordering-dependent flaky test in highlighters (highlightLayer relied on extension.activate() having run in another test file first) by stubbing vulnTreeDataProvider locally.
Introduce a justfile as a thin facade over the package.json scripts plus the nix/OS-specific glue (watch, test, lint, vsix, publish-*, update). The test and release workflows now run inside `nix develop`, so just/node/vsce are pinned by the flake, and the VSIX is built and published with nix (verified byte-identical to `vsce package`, so publishing stays compatible). lint audits dependencies but fails only when a fix is actually available, so unfixable transitive dev vulns don't block commits. Fix .vscodeignore to exclude the lowercase `justfile`, the nix `result` symlink and `*.vsix`, which were leaking into the package.
alecron
approved these changes
Jul 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The extension shipped every tsc-emitted file plus the full
node_modulestree in the.vsix(198 files, 361KB). Bundlingsrc/extension.tsinto a single minifieddist/extension.jswith esbuild inlines the runtime deps (all pure JS,vscodeleft external) and dropsnode_modulesfrom the package entirely:.vsix(compressed)Faster activation too: the host resolves one module instead of ~190.
tscis kept for type-checking (--noEmit) and for compiling tests toout/, so test coverage is unaffected. Nix (vsix.nix) already derives deps viaimportNpmLock, so no hash to maintain;vsce packagenow runs the esbuild-basedvscode:prepublish.Also fixes a pre-existing ordering-dependent flaky test in
highlighters(highlightLayerrelied onextension.activate()having run in another test file first, leavingvulnTreeDataProviderundefined otherwise) by stubbing it locally in setup.Note: the
pre-commitlint hook also runsnpm audit, which fails on a pre-existingserialize-javascriptadvisory pulled in via@vscode/test-cli → mocha(no fix available, unrelated to this change). esbuild itself has zero dependencies.